How do I report a security vulnerability in Osclass?

Email info@osclass-classifieds.com with the subject Security report. Include the Osclass version, the affected file or URL, steps to reproduce, and any plugin or theme involved. Do not post exploit details in public before a fixed release is out.

Which Osclass versions get security fixes?

Only the current 8.x release line. Sites on 3.x or older, or on unofficial forks, get no fixes and should upgrade to the current release from the download page.

How many CVEs does Osclass have?

OpenCVE lists about 10 CVEs for Osclass, mostly in the old 2.x and 3.x lines from 2012-2018. WebTechSurvey detects about 1,700 live Osclass sites, so a short CVE list also reflects a small install base. Neither number makes a site safe without updates.

How do I harden an Osclass site?

Run the current release, use HTTPS, rename the admin folder with OC_ADMIN_FOLDER, give each admin a separate strong account, turn on admin approval and Turnstile against spam, delete unused plugins, keep only oc-content upload folders writable, and test backups by restoring them.

Osclass Security

How to report a vulnerability, how fixes ship, and how to harden your site

Osclass is maintained by OsclassPoint, and security fixes ship in the current 8.x release line (latest: 8.4.0). If you found a vulnerability in Osclass core, report it privately by email so it can be fixed before details are public. Site owners will find the CVE history and a hardening checklist below.

Report a security issue

Email info@osclass-classifieds.com with the subject Security report. Include:

The Osclass version (shown in oc-admin and in oc-includes/osclass/default-constants.php)
The affected file, URL, or admin screen
Steps to reproduce, and what an attacker could do with it
Whether a plugin or theme is involved, and which one

Do not post exploit details in the forums, on GitHub, or on social media before a fixed release is out. For problems in a theme or plugin from OsclassPoint, use the same address; for third-party extensions, contact their author. The same contact is published in security.txt.

How fixes ship

Security fixes go into regular Osclass releases and are listed in the changelog. The current stable ZIP is always on the download page, and the installation guide covers upgrades that keep your oc-content data.

Only the current 8.x line receives fixes. Sites still on 3.x or older, or on unofficial forks, get none and should upgrade. W3Techs still detects many Osclass sites on version 3, and those old installs are where most real risk sits.

CVE history

OpenCVE lists about 10 CVEs for Osclass, mostly in the old 2.x and 3.x lines (2012-2018). WebTechSurvey detects about 1,700 live Osclass sites. For scale, Patchstack counted 11,334 vulnerabilities in the WordPress ecosystem in 2025, most of them in plugins and themes, across tens of millions of sites.

A short CVE list partly reflects a smaller install base and fewer researchers looking. It does not make a site safe on its own. Stay on the current release and patch plugins.

Hardening checklist for a live site

Run the current Osclass release on a PHP version your host still supports.
Use HTTPS and set WEB_PATH in config.php to the https URL.
Rename the admin folder with OC_ADMIN_FOLDER, and do not list the new path in robots.txt.
Give each admin a separate account with a strong password; remove accounts nobody uses.
Turn on Require Admin Approval for new sellers and add Cloudflare Turnstile to registration and contact forms.
Deactivate and delete plugins and themes you do not use.
Keep only oc-content/uploads, downloads, and languages writable; make config.php read-only after install.
Back up files and database daily, and restore a backup on staging at least once a month.
Test core and plugin updates on staging before production.

Frequently asked questions

How do I report a security vulnerability in Osclass?: Email info@osclass-classifieds.com with the subject Security report. Include the Osclass version, the affected file or URL, steps to reproduce, and any plugin or theme involved. Do not post exploit details in public before a fixed release is out.
Which Osclass versions get security fixes?: Only the current 8.x release line. Sites on 3.x or older, or on unofficial forks, get no fixes and should upgrade to the current release from the download page.
How many CVEs does Osclass have?: OpenCVE lists about 10 CVEs for Osclass, mostly in the old 2.x and 3.x lines from 2012-2018. WebTechSurvey detects about 1,700 live Osclass sites, so a short CVE list also reflects a small install base. Neither number makes a site safe without updates.
How do I harden an Osclass site?: Run the current release, use HTTPS, rename the admin folder with OC_ADMIN_FOLDER, give each admin a separate strong account, turn on admin approval and Turnstile against spam, delete unused plugins, keep only oc-content upload folders writable, and test backups by restoring them.